Index: refpolicy-2.20260801/policy/modules/apps/thunderbird.te
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/thunderbird.te
+++ refpolicy-2.20260801/policy/modules/apps/thunderbird.te
@@ -34,19 +34,25 @@ optional_policy(`
 #
 
 allow thunderbird_t self:capability sys_nice;
-allow thunderbird_t self:process { execheap execmem execstack getsched setsched signal_perms };
+allow thunderbird_t self:process { execheap execmem execstack getsched setsched signal_perms setcap ptrace getcap setrlimit };
 allow thunderbird_t self:fifo_file rw_fifo_file_perms;
 allow thunderbird_t self:unix_dgram_socket create_socket_perms;
 allow thunderbird_t self:unix_stream_socket create_stream_socket_perms;
 allow thunderbird_t self:shm create_shm_perms;
 
+allow thunderbird_t self:user_namespace create;
+# sys_admin is needed for unshare(CLONE_NEWPID)
+allow thunderbird_t self:cap_userns { sys_admin sys_chroot };
+
 manage_dirs_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
 manage_files_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
 manage_lnk_files_pattern(thunderbird_t, thunderbird_home_t, thunderbird_home_t)
 userdom_user_home_dir_filetrans(thunderbird_t, thunderbird_home_t, dir, ".thunderbird")
+userdom_user_home_dir_filetrans(thunderbird_t, thunderbird_home_t, file)
 
 manage_dirs_pattern(thunderbird_t, thunderbird_tmp_t, thunderbird_tmp_t)
 manage_files_pattern(thunderbird_t, thunderbird_tmp_t, thunderbird_tmp_t)
+allow thunderbird_t thunderbird_tmp_t:file map;
 manage_lnk_files_pattern(thunderbird_t, thunderbird_tmp_t, thunderbird_tmp_t)
 files_tmp_filetrans(thunderbird_t, thunderbird_tmp_t, { dir file lnk_file })
 
@@ -62,8 +68,10 @@ xdg_cache_filetrans(thunderbird_t, thund
 
 kernel_read_network_state(thunderbird_t)
 kernel_read_net_sysctls(thunderbird_t)
+kernel_read_sysctl(thunderbird_t)
 kernel_read_system_state(thunderbird_t)
 
+corecmd_exec_bin(thunderbird_t)
 corecmd_exec_shell(thunderbird_t)
 
 corenet_all_recvfrom_netlabel(thunderbird_t)
@@ -85,9 +93,18 @@ corenet_tcp_connect_pop_port(thunderbird
 corenet_sendrecv_http_client_packets(thunderbird_t)
 corenet_tcp_connect_http_port(thunderbird_t)
 
+corenet_tcp_connect_xserver_port(thunderbird_t)
+
+corenet_udp_bind_generic_node(thunderbird_t)
+
+dev_read_sysfs(thunderbird_t)
 dev_read_urand(thunderbird_t)
+dev_rw_dma_dev(thunderbird_t)
+dev_rw_dri(thunderbird_t)
 dev_dontaudit_search_sysfs(thunderbird_t)
 
+domain_use_interactive_fds(thunderbird_t)
+
 files_list_tmp(thunderbird_t)
 files_map_usr_files(thunderbird_t)
 files_read_usr_files(thunderbird_t)
@@ -98,26 +115,46 @@ files_dontaudit_getattr_all_tmp_files(th
 files_dontaudit_getattr_boot_dirs(thunderbird_t)
 files_dontaudit_getattr_lost_found_dirs(thunderbird_t)
 files_dontaudit_search_mnt(thunderbird_t)
+files_watch_etc_dirs(thunderbird_t)
+files_watch_usr_dirs(thunderbird_t)
 
 fs_getattr_all_fs(thunderbird_t)
 fs_list_inotifyfs(thunderbird_t)
+fs_read_cgroup_files(thunderbird_t)
 fs_search_auto_mountpoints(thunderbird_t)
 
 auth_use_nsswitch(thunderbird_t)
 
-miscfiles_read_fonts(thunderbird_t)
+logging_send_syslog_msg(thunderbird_t)
+
+miscfiles_manage_fonts_cache(thunderbird_t)
 miscfiles_read_localization(thunderbird_t)
 
+userdom_exec_user_bin_files(thunderbird_t)
 userdom_write_user_tmp_sockets(thunderbird_t)
 userdom_manage_user_tmp_dirs(thunderbird_t)
 userdom_manage_user_tmp_files(thunderbird_t)
+userdom_map_user_tmp_files(thunderbird_t)
+userdom_use_user_ptys(thunderbird_t)
+userdom_use_user_ttys(thunderbird_t)
 userdom_user_content_access_template(thunderbird, thunderbird_t)
 
+
 xdg_read_data_files(thunderbird_t)
+xdg_manage_cache(thunderbird_t)
+xdg_read_config_files(thunderbird_t)
 xdg_manage_downloads(thunderbird_t)
+xdg_watch_config_dirs(thunderbird_t)
+xdg_watch_data_dirs(thunderbird_t)
+
+# for .local/share/sddm/wayland-session.log
+xdg_manage_data(thunderbird_t)
 
+xserver_manage_mesa_shader_cache(thunderbird_t)
 xserver_user_x_domain_template(thunderbird, thunderbird_t, thunderbird_tmpfs_t)
 xserver_read_xdm_tmp_files(thunderbird_t)
+xserver_read_xkb_libs(thunderbird_t)
+xserver_rw_mesa_shader_cache(thunderbird_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
 
 tunable_policy(`use_nfs_home_dirs',`
@@ -139,8 +176,13 @@ ifndef(`enable_mls',`
 ')
 
 optional_policy(`
+	chromium_domtrans(thunderbird_t)
+')
+
+optional_policy(`
 	dbus_system_bus_client(thunderbird_t)
 	dbus_all_session_bus_client(thunderbird_t)
+	dbus_connect_all_session_bus(thunderbird_t)
 
 	optional_policy(`
 		cups_dbus_chat(thunderbird_t)
@@ -149,6 +191,10 @@ optional_policy(`
 	optional_policy(`
 		mozilla_dbus_chat(thunderbird_t)
 	')
+
+	optional_policy(`
+		ntp_dbus_chat(thunderbird_t)
+	')
 ')
 
 optional_policy(`
@@ -160,6 +206,8 @@ optional_policy(`
 	gnome_stream_connect_gconf(thunderbird_t)
 	gnome_domtrans_gconfd(thunderbird_t)
 	gnome_manage_generic_home_content(thunderbird_t)
+	gnome_mmap_read_xdg_config_files(thunderbird_t)
+	gnome_watch_xdg_config_dirs(thunderbird_t)
 ')
 
 optional_policy(`
@@ -179,3 +227,12 @@ optional_policy(`
 	ooffice_domtrans(thunderbird_t)
 	ooffice_rw_tmp_files(thunderbird_t)
 ')
+
+optional_policy(`
+	rtkit_daemon_dbus_chat(thunderbird_t)
+')
+
+optional_policy(`
+	systemd_dbus_chat_logind(thunderbird_t)
+	systemd_dbus_chat_hostnamed(thunderbird_t)
+')
Index: refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/kernel/corecommands.fc
+++ refpolicy-2.20260801/policy/modules/kernel/corecommands.fc
@@ -257,6 +257,8 @@ ifdef(`distro_gentoo',`
 /usr/lib/systemd/systemd.*	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/systemd/system-shutdown(/.*)?	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/systemd/system-sleep(/.*)?	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/thunderbird/glxtest	--	gen_context(system_u:object_r:bin_t,s0)
+/usr/lib/thunderbird/vaapitest	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/tumbler-1/tumblerd	--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/udev/[^/]*			--	gen_context(system_u:object_r:bin_t,s0)
 /usr/lib/udev/scsi_id		--	gen_context(system_u:object_r:bin_t,s0)
Index: refpolicy-2.20260801/policy/modules/apps/thunderbird.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/apps/thunderbird.if
+++ refpolicy-2.20260801/policy/modules/apps/thunderbird.if
@@ -72,3 +72,24 @@ interface(`thunderbird_domtrans',`
 	corecmd_search_bin($1)
 	domtrans_pattern($1, thunderbird_exec_t, thunderbird_t)
 ')
+
+########################################
+## <summary>
+##      Send and receive messages from
+##      thunderbird over dbus.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`thunderbird_dbus_chat',`
+	gen_require(`
+		type thunderbird_t;
+		class dbus send_msg;
+	')
+
+	allow $1 thunderbird_t:dbus send_msg;
+	allow thunderbird_t $1:dbus send_msg;
+')
Index: refpolicy-2.20260801/policy/modules/system/userdomain.if
===================================================================
--- refpolicy-2.20260801.orig/policy/modules/system/userdomain.if
+++ refpolicy-2.20260801/policy/modules/system/userdomain.if
@@ -204,6 +204,10 @@ template(`userdom_base_user_template',`
 	')
 
 	optional_policy(`
+		thunderbird_dbus_chat($1_t)
+	')
+
+	optional_policy(`
 		xscreensaver_send_dbus($1_t)
 	')
 ')
